Source review dated 8 November 2026. Provider settings and acceptance exercises below are documentary guidance, not executed account, DNS or message tests.
Start with the migrated service
A new legacy Pobox setup recipe would misstate the current product. Fastmail says Pobox merged into Fastmail effective November 12, 2024, with all Pobox customers migrated. This guide therefore covers checking a former Pobox custom domain in its current Fastmail account. It does not claim that a separate current Pobox signing console exists. Fastmail guide for Pobox users
First identify which address the organization sends from, who owns its DNS, and where the sender logs in. A provider-owned Pobox address is different from a custom domain the organization controls. You cannot publish authentication records for a provider's domain merely because an alias belongs to you. Keep provider-address troubleshooting with support and restrict DNS changes to authorized domains.
Fastmail's migration guidance says existing personal domains continue working without DNS changes, and previously configured mail clients should continue working. It recommends Fastmail servers for newly configured clients. Inspect the actual domain status under Settings > Domains before proposing a migration-related DNS overhaul. A service's changed brand alone is not evidence that records must be replaced. Fastmail migration guidance
Separate receipt and forwarding from sending
Make two route inventories. One describes messages arriving at an alias and being forwarded to a destination. The other describes messages authored by the user and submitted through a mail client, webmail, application, or another SMTP provider. These paths can fail for different reasons even when they share a visible address.
For an outbound authentication complaint, capture a fresh message sent by the account through the actual route. If a desktop client is still submitting through an unrelated mailbox provider, a correctly configured Fastmail domain does not prove that client's message receives a Fastmail signature. Conversely, changing MX records for inbound delivery does not establish which outbound server the client uses.
Fastmail documents that forwarding can disrupt authentication and that DKIM can also be affected when clients alter messages. Evaluate forwarded mail independently rather than treating a successful direct message as proof of every forwarded third-party message. Never add arbitrary originating senders to your domain's SPF merely to accommodate forwarded mail. Fastmail DMARC guidance
Use current account instructions for justified changes
For a custom domain requiring setup or repair, use its current Fastmail domain instructions. The manual DNS guide lists three DKIM CNAME owners, fm1._domainkey, fm2._domainkey, and fm3._domainkey, with domain-specific targets. It says to add all three. The older mesmtp selector is identified as deprecated for domains hosted before 2018, not presented as the normal new setup. Fastmail manual DNS configuration
Treat the public examples as a description of the current pattern, not proof that an inherited migrated domain needs immediate replacement. Compare current account status, published records, and the selector actually used in a received signature. If they disagree, retain the evidence and seek a migration-specific explanation before removing functioning trust. Preserve any existing selector that a live route still uses until an approved transition is complete.
The same manual includes the SPF authorization include:spf.messagingengine.com. Incorporate any required change into the existing single policy at the relevant domain, retaining other legitimate senders. Do not copy the guide's entire example over an organization's deliberately chosen policy. An SPF edit must be evaluated for lookup limits and actual envelope use, not just whether a branded include appears in DNS. Fastmail manual DNS configuration SPF RFC 7208
Evaluate identities from a received message
Record the visible From domain, SMTP MAIL FROM or Return-Path domain, and every DKIM signing domain and selector. Use the receiving system's trusted Authentication-Results rather than an untrusted header supplied by the sender. Compare the successful authentication identity with the From domain under the domain's alignment settings. Passing provider-domain SPF is not automatically aligned with a customer domain. DKIM RFC 6376 DMARC RFC 9989
Check at least the actively used webmail or desktop route and any application sending as the same custom domain. For forwarded traffic, record the original sender and final receiver separately. Keep a received-message identifier in the evidence bundle, but redact content and personal addresses from public documentation. Authentication testing is not a reason to circulate private correspondence.
A DMARC pass establishes an authentication and alignment result for that message. It does not promise inbox placement, restore an alias that was not migrated, or fix a mail client's login. Classify the symptom before deciding which team owns the repair.
Former Pobox domain worksheet
Use this worksheet to avoid applying a generic Fastmail recipe to the wrong account.
- Account lineage: former Pobox account reference, current Fastmail account owner, and migration-specific domain status.
- Address ownership: provider-owned address or customer-controlled domain; authorized DNS administrator.
- Outbound route: client or application, actual SMTP service, intended From, and whether an external sending identity is involved.
- Current records: authoritative nameservers, SPF policy, active DKIM selectors and targets, current DMARC policy, and collection time.
- Test evidence: direct versus forwarded message, receiver, envelope domain, signing domain, selector, authentication outcomes, and alignment conclusion.
- Decision: leave functioning inherited setup unchanged, repair a verified mismatch, or escalate a migration exception; owner and rollback condition.
Fictional diagnosis of a misleading migration complaint
This scenario is fictional. A consultant's domain appears active in Fastmail after Pobox migration, but invoices sent from a desktop client fail DMARC. The consultant proposes replacing all DNS with the current Fastmail examples. A controlled webmail message passes with an aligned signature, while the invoice is submitted to an old unrelated SMTP host and carries that host's signing domain.
The evidence suggests a client-route issue, not proof that the inherited domain is broken. The proposed next step is to confirm the intended SMTP service and correct the client using authorized account setup instructions, then send another invoice-shaped test without real customer data. The desired aligned result must still be observed. Wholesale MX replacement would not address the demonstrated difference between the two sending paths.
Scope and release gates
This manuscript is a migration-aware verification guide, not a validated legacy Pobox installation procedure. No account, live DNS zone, client configuration, or customer message was inspected. A human SME must confirm the current migration behavior and account-specific exceptions. Route tests and editorial visual review remain pending, and the draft is unpublished. A broader Pobox configuration title remains held because current first-party evidence supports Fastmail as the operating service.